Privacy Policy.

Who we are

BABAV.CO ("BABAV", "we", "us") runs an omnichannel AI assistant that helps small brands and creators manage conversations, publish content, and run outreach across their connected social and email channels.

This policy covers everyone who touches the service: visitors, trial users, paying customers, and the people our customers interact with whose messages flow through the product.

Controller vs. processor. For your own account, billing, and usage data, BABAV is the data controller. For the content that passes through the service on your behalf — the messages, comments, and contacts of the people you reach — you are the controller and BABAV is your processor, acting on your instructions. Need a Data Processing Agreement? Email support@babav.co.

What we collect

You give us

• Account — your email and workspace/brand details. You sign in with a one-time email link; we never store passwords.
• Billing — company name and billing details. Card numbers are handled by Stripe and never touch our servers.
• Brand configuration — your voice settings, knowledge base, rules, and per-channel preferences.
• Support — anything you email us.

From your connected channels

When you connect a channel (Threads, Instagram, Facebook, WhatsApp, YouTube, Gmail, TikTok, X, Telegram, Discord, LinkedIn, and Twitch), we receive what that platform's OAuth scope or bot connection grants — typically incoming DMs, comments, mentions, or emails, basic profile metadata for the people interacting with you, and permission to publish or reply on your behalf. We request only the scopes the features you turn on actually need.

Automatically

• Usage and action counts (needed to bill accurately), error logs, and performance telemetry.
• Basic device/network data including IP address, used for security and abuse prevention.

How we use it

• Operate the service — generate and send replies, publish content, score and add leads, run outreach.
• Bill you accurately, which means counting the actions we successfully complete for you.
• Detect and prevent fraud, abuse, and security incidents.
• Improve reliability from operational logs and aggregated metrics.
• Send operational email (receipts, security notices) and, only if you opt in, product updates.
• Meet a genuine legal obligation when we actually have one.

AI processing & training

BABAV uses Google Vertex AI for its AI features: Gemini writes text replies, drafts, and summaries; Veo and Gemini make video and images. Some features use other AI companies — all are listed under “Outside services we use” below. Your data is stored in the United States (Google Cloud, us-west1); AI requests run in Google’s US regions, and newer Gemini models use Google’s global endpoint.

Under Google's Vertex AI terms, your inputs and outputs are not used to train Google's or any third party's models.

Google user data

Where you connect Gmail or YouTube, BABAV's use of Google user data follows the Google API Services User Data Policy, including the Limited Use requirements.

• Gmail — send only (gmail.send): to send the outreach and replies you compose or approve. This scope cannot read your inbox.
• Gmail inbox answering — not offered yet (gmail.modify): if we switch it on, it asks you for a separate Google permission that can read your inbox and write draft replies. You choose whether to grant it, and you can remove it anytime in your Google account.
• YouTube: only if you connect a channel, to publish videos you generate to your own channel.
• Basic profile (openid, email, profile): to sign you in.

We request scopes incrementally, only when you enable the feature. We do not use Google user data for advertising, do not sell it, and do not use it to train generalized AI models. You can revoke access anytime from your Google Account permissions.

How we share data

• Outside services — the companies listed below, each bound by a data-processing agreement.
• Connected platforms — when you publish or reply, we transmit that content to the platform you connected, on your behalf.
• Legal — a valid legal demand, complied with to the extent required, and we notify you unless prohibited.
• Corporate change — if BABAV is acquired, your data may transfer under terms at least as protective as this policy.

No mobile information will be sold or shared with third parties for promotional or marketing purposes. Text messaging originator opt-in data and consent are never shared with any third party. Phone numbers collected for SMS are used only to deliver the messages you asked for, and are never rented, sold, or passed to anyone else's marketing.

There is no scenario where your customers' messages end up in someone else's product.

Outside services we use

These companies handle data for us so BABAV can work. Each gets only what its job needs.

Always in use

• Google Cloud — runs BABAV and stores your data (Cloud Run, Firestore, Cloud Storage, Firebase Hosting, Text-to-Speech for video voice-overs). Stored in the United States (us-west1).
• Google Vertex AI — Gemini writes replies, drafts and summaries; Veo and Gemini make video and images. Runs in Google’s US regions; newer Gemini models use Google’s global endpoint.
• Stripe — payments and billing. Your card number stays with Stripe.
• Resend — sends our email (sign-in links, receipts, alerts) and the outreach email you send.
• Postmark — receives replies to your outreach email, so you see them in BABAV without us reading your inbox.
• Reoon — checks that email addresses on your outreach lists are real.
• Google Analytics and Plausible — site and app usage stats (see Cookies).

Only when you use that feature

• Telnyx — phone calls, texts and WhatsApp numbers, sign-in codes by text, and voicemail recordings. Handles STOP/START opt-outs.
• Deepgram — turns speech on phone calls into text (through Telnyx).
• ElevenLabs — voice-overs on generated video, and voice cloning if you use it.
• Together AI — makes still images from an image prompt.
• Cloudflare — runs the web address for a white label dashboard on its own domain.

Built, and only used once switched on (some are tested on our own accounts first)

• Groq, Cloudflare Workers AI, OpenRouter, Mistral, Cerebras and Google AI Studio — other AI models for jobs nobody is waiting on, like drafting posts from your own brand material. Never messages from your customers.
• RunPod — lower-cost video generation.
• LiveKit — video and voice call rooms.
• Tavus — the talking AI video character.
• Amazon SES — sending email from your own domain.

Services you connect. When you connect an account — Meta (Facebook, Instagram, Threads, WhatsApp), Google (Gmail, YouTube, Business Profile, Calendar, Sheets), Microsoft (Outlook, Teams), X, TikTok, LinkedIn, Pinterest, Bluesky, Mastodon, Telegram, Discord, Twitch, Slack, Notion, Trello, HubSpot, Pipedrive, GoHighLevel, Mailchimp, Kit, Calendly, Cal.com, Shopify, Wix, Squarespace, WooCommerce or your own Twilio — we send it only what you ask us to, on your behalf. Their own privacy terms apply.

We will tell account owners before this list changes in a way that matters.

Security

• OAuth tokens for every connected channel are encrypted at rest with AES-256-GCM; the encryption key is held in Google Secret Manager and never stored alongside the data.
• Sign-in is passwordless (one-time email link); sessions are short-lived, signed tokens.
• All traffic runs over HTTPS/TLS.
• Production access is limited, authenticated, and logged.

No system is perfect. If a breach ever affects your data, we will notify affected account owners promptly with what we know and what we are doing.

Retention

• Active account data — kept while your account is active, then purged on deletion (see below).
• Channel tokens — wiped within minutes of disconnecting a channel.
• Billing records — retained as long as tax and accounting law requires.
• Backups — encrypted and roll off on a rolling ~90-day cycle.
• Aggregated analytics — retained without personal identifiers.

Deletion & your rights

You can delete everything yourself in Settings → Account → Delete account, disconnect any single channel from Settings → Connections, or email us to do it for you. Full details and timelines are on our Data Deletion page.

Depending on where you live, you may have the right to access, correct, delete, export (as one JSON file), restrict or object to processing, withdraw consent, and lodge a complaint with your data-protection authority. To exercise any of these, email support@babav.co; we aim to respond within 30 days. For California residents: we do not "sell" personal information.

International transfers

Our infrastructure is in the United States (Google Cloud, us-west1). If you use BABAV from elsewhere, your data is processed in the US. For EU, UK, and Swiss users we rely on Standard Contractual Clauses.

Children

BABAV is a business tool and is not directed at children under 16. We do not knowingly collect their data; if you believe we have, contact us and we will delete it.

Cookies

We keep cookies minimal and load site analytics only after you accept them. Full detail — including our use of Google Analytics 4 with Consent Mode — is in the Cookie Policy.

Changes & contact

We update this policy when our practices change and revise the date above; material changes are emailed to account owners in advance. Anything privacy-related: support@babav.co — a real person reads it.